PhpSpreadsheet prior to version 1.30.5 contains a deserialization of untrusted data vulnerability due to an incomplete check in the File::prohibitWrappers helper. The helper attempts to block stream wrappers by parsing the URL scheme and rejecting certain wrappers. However, when the input path uses a phar wrapper with three or more slashes (e.g., phar:///path/file.phar/inner), parse_url returns false for the scheme, causing the check to be bypassed. PHP's stream layer still processes the phar wrapper, leading to automatic deserialization of phar metadata on PHP 7.x during file existence checks. This triggers magic methods (__wakeup and __destruct) in attacker-controlled objects, resulting in full remote code execution. On PHP 8.x, automatic deserialization for plain file operations was removed, so exploitation requires the downstream code to explicitly call Phar::getMetadata. The vulnerability is addressed in PhpSpreadsheet 1.30.5.

On PHP 7.x environments using vulnerable PhpSpreadsheet versions, an attacker can achieve remote code execution by supplying a crafted file path that exploits the phar wrapper deserialization. On PHP 8.x, the risk is reduced but still present if the application calls Phar::getMetadata on attacker-controlled files. This vulnerability allows execution of arbitrary code without authentication, posing a critical security risk.

Upgrade PhpSpreadsheet to version 1.30.5 or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Users running PHP 7.x should prioritize patching due to the higher risk of automatic deserialization leading to RCE. For PHP 8.x, ensure that downstream code does not invoke Phar::getMetadata on untrusted inputs. Patch status is not explicitly stated as 'official-fix' in the advisory, but the vulnerability is fixed in version 1.30.5.